Ransomware attacks continue to evolve with double-extortion tactics and targeted enterprise campaigns. This section analyzes ransomware groups, attack patterns, and defensive strategies CISOs must understand.
62 articles
Progress has directed ShareFile customers to immediately shut down Storage Zone Controllers following a credible ransomware threat. No unauthorized access or data compromise has been confirmed, but account access has been restricted as a precaution.
Langflow suffered a critical ransomware incident when the JadePuffer campaign exploited CVE-2025-3248, leading to the autonomous encryption and deletion of 1342 Alibaba Nacos service configurations. The attack was fully orchestrated by a large language model, compressing multi-stage operations into minutes and leaving no possibility of data recovery.
DigitalMint suffered a critical ransomware incident after an insider leaked confidential negotiation data to BlackCat, resulting in higher extortion demands. The breach also implicated Sygnia Cybersecurity Services and led to $1.2 million in losses.
Multiple U.S. organizations, including a Michigan company, an Oregon technology firm, and a Texas school, suffered data encryption and operational disruption after Ryuk ransomware attacks orchestrated by Karen Serobovich Vardanyan. Victims paid over $15 million in Bitcoin ransoms.
Multiple organizations worldwide were compromised through Citrix NetScaler appliances, with at least one suffering DragonForce ransomware deployment following privilege escalation via CitrixBleed 2.
The Gentlemen ransomware group compromised over 580 organizations worldwide, including 103 manufacturing firms, using custom malware and zero-day exploits. Their attacks caused widespread operational disruption and leveraged a Ransomware-as-a-Service model.
A targeted organization suffered a GodDamn ransomware attack in June 2026, with threat actors using the PoisonX driver to disable endpoint defenses and facilitate widespread data encryption.
Bandai Channel suffered a critical ransomware attack orchestrated by the autonomous AI JadePuffer, resulting in service disruption and nearly 47,000 anime streaming subscriptions being cancelled. The incident marks a significant escalation in the use of AI for fully automated cyberattacks.
Union County, Ohio suffered a ransomware attack by the Kairos group, resulting in the theft of over 2TB of sensitive data. The county paid $1 million in Bitcoin to prevent public release of information affecting 45,487 individuals.
Sysdig was impacted by JadePuffer, the first AI-driven ransomware attack, which encrypted over 1,300 configuration records and stole credentials. The AI agent autonomously exploited vulnerabilities, raising new concerns about attack scalability.
Qilin, a ransomware-as-a-service operation, has rapidly become the dominant ransomware group, compromising nearly 1,500 organizations over the past year. The group’s mature infrastructure and aggressive tactics have led to significant disruption and increased law enforcement scrutiny.
Blackpoint Cyber was targeted by the Avalon malware framework, which deployed CrownX ransomware via multi-stage phishing. Attackers exfiltrated credentials and cryptocurrency wallets, disrupted recovery, and demanded escalating ransom.